The personal‑authors‑category plugin for WordPress is vulnerable to Reflected Cross‑Site Scripting via the URL path in all versions up to and including 0.3. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject arbitrary web scripts into pages that execute when a user visits a crafted link. The injected code runs in the context of the victim’s browser, providing the attacker with the ability to execute arbitrary scripts within that session.

Any WordPress installation that uses the personal‑authors‑category plugin by alexeyknyazev and is running version 0.3 or older is susceptible. This includes any environment where the plugin has been activated and the URL authoring function is accessible.

The flaw carries a CVSS score of 6.1, indicating moderate severity, and an EPSS score of less than 1 %, suggesting low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector involves an unauthenticated attacker sending aly crafted URL to a victim; when the victim clicks the link, the payload is reflected and executed. No additional prerequisites are required beyond user interaction, making the vulnerability readily exploitable when the user follows the link.